Read the docs
TI-2021-15830 Aliases CVE-2021-38150GHSA-5qm4-cm2h-3cgf

Cleartext storage of sensitive information in SAP Business Client

Priority LOW 29CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.

Why it matters now

EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed SAP Business Client (SAP SE): 7.0, 7.70

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Clientbefore 7.0; before 7.707.0, 7.70Patch availableCNA
  • SAP Business Client VendorSAP Affected before 7.0; before 7.70 Fixed in 7.0, 7.70 Patch available CNA

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:*6.0VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:*6.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:*6.0 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:*6.0 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:*6.0 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:*6.0 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:*6.0 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:*6.0 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:*6.0 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:*6.0 patch_level17VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:* Versions 6.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:* Versions 6.0 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:* Versions 6.0 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:* Versions 6.0 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:* Versions 6.0 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:* Versions 6.0 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:* Versions 6.0 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:* Versions 6.0 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:* Versions 6.0 patch_level17 Vulnerable ·SAP
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:*6.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:*6.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:*6.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:*6.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:*6.0 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:*6.0 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:*6.0 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:*6.0 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:*6.5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:*6.5 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:*6.5 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:*6.5 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:*6.5 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:*6.5 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:*6.5 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:*6.5 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:*6.5 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:*6.5 patch_level17VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:*6.5 patch_level18VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:*6.5 patch_level19VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:*6.5 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level20:*:*:*:*:*:*6.5 patch_level20VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level21:*:*:*:*:*:*6.5 patch_level21VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level22:*:*:*:*:*:*6.5 patch_level22VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:*6.5 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:*6.5 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:*6.5 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:*6.5 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:*6.5 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:*6.5 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:*6.5 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:*7.0VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:*7.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level10:*:*:*:*:*:*7.0 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level11:*:*:*:*:*:*7.0 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level12:*:*:*:*:*:*7.0 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level13:*:*:*:*:*:*7.0 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level14:*:*:*:*:*:*7.0 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level15:*:*:*:*:*:*7.0 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level16:*:*:*:*:*:*7.0 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level17:*:*:*:*:*:*7.0 patch_level17VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level18:*:*:*:*:*:*7.0 patch_level18VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level19:*:*:*:*:*:*7.0 patch_level19VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:*7.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level20:*:*:*:*:*:*7.0 patch_level20VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:*7.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:*7.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:*7.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:*7.0 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level7:*:*:*:*:*:*7.0 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level8:*:*:*:*:*:*7.0 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level9:*:*:*:*:*:*7.0 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:-:*:*:*:*:*:*7.70VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:patch_level1:*:*:*:*:*:*7.70 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:patch_level2:*:*:*:*:*:*7.70 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:patch_level3:*:*:*:*:*:*7.70 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:patch_level4:*:*:*:*:*:*7.70 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:7.70:patch_level5:*:*:*:*:*:*7.70 patch_level5VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:* Versions 6.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:* Versions 6.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:* Versions 6.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:* Versions 6.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:* Versions 6.0 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:* Versions 6.0 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:* Versions 6.0 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:* Versions 6.0 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:* Versions 6.5 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:* Versions 6.5 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:* Versions 6.5 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:* Versions 6.5 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:* Versions 6.5 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:* Versions 6.5 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:* Versions 6.5 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:* Versions 6.5 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:* Versions 6.5 patch_level17 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:* Versions 6.5 patch_level18 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:* Versions 6.5 patch_level19 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:* Versions 6.5 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level20:*:*:*:*:*:* Versions 6.5 patch_level20 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level21:*:*:*:*:*:* Versions 6.5 patch_level21 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level22:*:*:*:*:*:* Versions 6.5 patch_level22 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:* Versions 6.5 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:* Versions 6.5 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:* Versions 6.5 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:* Versions 6.5 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:* Versions 6.5 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:* Versions 6.5 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:* Versions 6.5 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:* Versions 7.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level10:*:*:*:*:*:* Versions 7.0 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level11:*:*:*:*:*:* Versions 7.0 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level12:*:*:*:*:*:* Versions 7.0 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level13:*:*:*:*:*:* Versions 7.0 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level14:*:*:*:*:*:* Versions 7.0 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level15:*:*:*:*:*:* Versions 7.0 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level16:*:*:*:*:*:* Versions 7.0 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level17:*:*:*:*:*:* Versions 7.0 patch_level17 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level18:*:*:*:*:*:* Versions 7.0 patch_level18 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level19:*:*:*:*:*:* Versions 7.0 patch_level19 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:* Versions 7.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level20:*:*:*:*:*:* Versions 7.0 patch_level20 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:* Versions 7.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:* Versions 7.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:* Versions 7.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:* Versions 7.0 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level7:*:*:*:*:*:* Versions 7.0 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level8:*:*:*:*:*:* Versions 7.0 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level9:*:*:*:*:*:* Versions 7.0 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:-:*:*:*:*:*:* Versions 7.70 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:patch_level1:*:*:*:*:*:* Versions 7.70 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:patch_level2:*:*:*:*:*:* Versions 7.70 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:patch_level3:*:*:*:*:*:* Versions 7.70 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:patch_level4:*:*:*:*:*:* Versions 7.70 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.70:patch_level5:*:*:*:*:*:* Versions 7.70 patch_level5 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Client (SAP SE) Fixed in 7.0, 7.70

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38150
  2. 2026-10-03 Alias added: GHSA-5qm4-cm2h-3cgf

References

Advisory 1

Other 1

  • TI-2018-01786 Under certain conditions SAP Business Client 6.5 allows an attacker to access information… CVSS 3.1HIGH 7.5
  • TI-2020-05100 Uncontrolled search path in SAP Business Client CVSS 3.1HIGH 7.8
  • TI-2020-05084 SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences